dcrat | 7fe5834f29daabc2f0034eff990a5dcadccdbbad7a6428eea416322020f2afef

General

Target

HEUR-Trojan.Win32.Generic-7fe5834f29daabc2f00.exe
Size

1.5MB
MD5

c532d809990659da1bc427ad039a7d5c
SHA1

6158717c914aea611074a14fd0527663e95ccb64
SHA256

7fe5834f29daabc2f0034eff990a5dcadccdbbad7a6428eea416322020f2afef
SHA512

b70d7d8f646d5bb1bb1a7bbd787c16647448d00291ed231b79e2193237d3ac1d00d584873cadccfea1a7494648a1c9050a056f42ce8d434a8b5318d4f2371d63
SSDEEP

12288:CC6105US81giZG7/N8vzvD//dH1P2TZeQmrD0:TUS813T

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 10 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

WinNetCache.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\SystemApps\\Microsoft.Windows.Search_cw5n1h2txyewy\\Cortana.Internal.Search\\SearchApp.exe\", \"C:\\Windows\\System32\\tetheringclient\\lsass.exe\", \"C:\\Users\\All Users\\Packages\\sppsvc.exe\", \"C:\\Windows\\System32\\ncuprov\\RuntimeBroker.exe\", \"C:\\Program Files\\Uninstall Information\\lsass.exe\""	WinNetCache.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\SystemApps\\Microsoft.Windows.Search_cw5n1h2txyewy\\Cortana.Internal.Search\\SearchApp.exe\", \"C:\\Windows\\System32\\tetheringclient\\lsass.exe\", \"C:\\Users\\All Users\\Packages\\sppsvc.exe\", \"C:\\Windows\\System32\\ncuprov\\RuntimeBroker.exe\", \"C:\\Program Files\\Uninstall Information\\lsass.exe\", \"C:\\Windows\\System32\\tsf3gip\\fontdrvhost.exe\""	WinNetCache.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\SystemApps\\Microsoft.Windows.Search_cw5n1h2txyewy\\Cortana.Internal.Search\\SearchApp.exe\", \"C:\\Windows\\System32\\tetheringclient\\lsass.exe\", \"C:\\Users\\All Users\\Packages\\sppsvc.exe\", \"C:\\Windows\\System32\\ncuprov\\RuntimeBroker.exe\", \"C:\\Program Files\\Uninstall Information\\lsass.exe\", \"C:\\Windows\\System32\\tsf3gip\\fontdrvhost.exe\", \"C:\\Windows\\System32\\advpack\\fontdrvhost.exe\""	WinNetCache.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\SystemApps\\Microsoft.Windows.Search_cw5n1h2txyewy\\Cortana.Internal.Search\\SearchApp.exe\", \"C:\\Windows\\System32\\tetheringclient\\lsass.exe\", \"C:\\Users\\All Users\\Packages\\sppsvc.exe\", \"C:\\Windows\\System32\\ncuprov\\RuntimeBroker.exe\", \"C:\\Program Files\\Uninstall Information\\lsass.exe\", \"C:\\Windows\\System32\\tsf3gip\\fontdrvhost.exe\", \"C:\\Windows\\System32\\advpack\\fontdrvhost.exe\", \"C:\\Windows\\SystemApps\\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\\AppxManifest\\StartMenuExperienceHost.exe\", \"C:\\Users\\Default\\spoolsv.exe\", \"C:\\odt\\upfc.exe\""	WinNetCache.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\SystemApps\\Microsoft.Windows.Search_cw5n1h2txyewy\\Cortana.Internal.Search\\SearchApp.exe\", \"C:\\Windows\\System32\\tetheringclient\\lsass.exe\", \"C:\\Users\\All Users\\Packages\\sppsvc.exe\""	WinNetCache.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\SystemApps\\Microsoft.Windows.Search_cw5n1h2txyewy\\Cortana.Internal.Search\\SearchApp.exe\", \"C:\\Windows\\System32\\tetheringclient\\lsass.exe\""	WinNetCache.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\SystemApps\\Microsoft.Windows.Search_cw5n1h2txyewy\\Cortana.Internal.Search\\SearchApp.exe\", \"C:\\Windows\\System32\\tetheringclient\\lsass.exe\", \"C:\\Users\\All Users\\Packages\\sppsvc.exe\", \"C:\\Windows\\System32\\ncuprov\\RuntimeBroker.exe\""	WinNetCache.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\SystemApps\\Microsoft.Windows.Search_cw5n1h2txyewy\\Cortana.Internal.Search\\SearchApp.exe\", \"C:\\Windows\\System32\\tetheringclient\\lsass.exe\", \"C:\\Users\\All Users\\Packages\\sppsvc.exe\", \"C:\\Windows\\System32\\ncuprov\\RuntimeBroker.exe\", \"C:\\Program Files\\Uninstall Information\\lsass.exe\", \"C:\\Windows\\System32\\tsf3gip\\fontdrvhost.exe\", \"C:\\Windows\\System32\\advpack\\fontdrvhost.exe\", \"C:\\Windows\\SystemApps\\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\\AppxManifest\\StartMenuExperienceHost.exe\""	WinNetCache.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\SystemApps\\Microsoft.Windows.Search_cw5n1h2txyewy\\Cortana.Internal.Search\\SearchApp.exe\", \"C:\\Windows\\System32\\tetheringclient\\lsass.exe\", \"C:\\Users\\All Users\\Packages\\sppsvc.exe\", \"C:\\Windows\\System32\\ncuprov\\RuntimeBroker.exe\", \"C:\\Program Files\\Uninstall Information\\lsass.exe\", \"C:\\Windows\\System32\\tsf3gip\\fontdrvhost.exe\", \"C:\\Windows\\System32\\advpack\\fontdrvhost.exe\", \"C:\\Windows\\SystemApps\\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\\AppxManifest\\StartMenuExperienceHost.exe\", \"C:\\Users\\Default\\spoolsv.exe\""	WinNetCache.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\SystemApps\\Microsoft.Windows.Search_cw5n1h2txyewy\\Cortana.Internal.Search\\SearchApp.exe\""	WinNetCache.exe

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\WinNetCache\WinNetCache.exe	dcrat
C:\Users\Admin\AppData\Roaming\WinNetCache\WinNetCache.exe	dcrat
behavioral2/memory/3564-137-0x0000000000490000-0x0000000000528000-memory.dmp	dcrat
C:\Windows\System32\ncuprov\RuntimeBroker.exe	dcrat
C:\Windows\System32\ncuprov\RuntimeBroker.exe	dcrat

Executes dropped EXE 2 IoCs

Processes:

WinNetCache.exeRuntimeBroker.exe

pid process

3564 WinNetCache.exe
4568 RuntimeBroker.exe

pid	process
3564	WinNetCache.exe
4568	RuntimeBroker.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WinNetCache.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	WinNetCache.exe

Adds Run key to start application 2 TTPs 20 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

WinNetCache.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Windows\\SystemApps\\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\\AppxManifest\\StartMenuExperienceHost.exe\""	WinNetCache.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\odt\\upfc.exe\""	WinNetCache.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Users\\All Users\\Packages\\sppsvc.exe\""	WinNetCache.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files\\Uninstall Information\\lsass.exe\""	WinNetCache.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\System32\\tsf3gip\\fontdrvhost.exe\""	WinNetCache.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\System32\\tetheringclient\\lsass.exe\""	WinNetCache.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\System32\\ncuprov\\RuntimeBroker.exe\""	WinNetCache.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files\\Uninstall Information\\lsass.exe\""	WinNetCache.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Users\\Default\\spoolsv.exe\""	WinNetCache.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Users\\Default\\spoolsv.exe\""	WinNetCache.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Windows\\SystemApps\\Microsoft.Windows.Search_cw5n1h2txyewy\\Cortana.Internal.Search\\SearchApp.exe\""	WinNetCache.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\System32\\tsf3gip\\fontdrvhost.exe\""	WinNetCache.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\System32\\advpack\\fontdrvhost.exe\""	WinNetCache.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\System32\\ncuprov\\RuntimeBroker.exe\""	WinNetCache.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\System32\\advpack\\fontdrvhost.exe\""	WinNetCache.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Windows\\SystemApps\\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\\AppxManifest\\StartMenuExperienceHost.exe\""	WinNetCache.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\odt\\upfc.exe\""	WinNetCache.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Windows\\SystemApps\\Microsoft.Windows.Search_cw5n1h2txyewy\\Cortana.Internal.Search\\SearchApp.exe\""	WinNetCache.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\System32\\tetheringclient\\lsass.exe\""	WinNetCache.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Users\\All Users\\Packages\\sppsvc.exe\""	WinNetCache.exe

Drops file in System32 directory 8 IoCs

Processes:

WinNetCache.exe

description	ioc	process
File created	C:\Windows\System32\ncuprov\RuntimeBroker.exe	WinNetCache.exe
File created	C:\Windows\System32\ncuprov\9e8d7a4ca61bd92aff00cc37a7a4d62a2cac998d	WinNetCache.exe
File created	C:\Windows\System32\tsf3gip\fontdrvhost.exe	WinNetCache.exe
File created	C:\Windows\System32\tsf3gip\5b884080fd4f94e2695da25c503f9e33b9605b83	WinNetCache.exe
File created	C:\Windows\System32\advpack\fontdrvhost.exe	WinNetCache.exe
File created	C:\Windows\System32\advpack\5b884080fd4f94e2695da25c503f9e33b9605b83	WinNetCache.exe
File created	C:\Windows\System32\tetheringclient\lsass.exe	WinNetCache.exe
File created	C:\Windows\System32\tetheringclient\6203df4a6bafc7c328ee7f6f8ca0a8a838a8a1b9	WinNetCache.exe

Drops file in Program Files directory 2 IoCs

Processes:

WinNetCache.exe

description	ioc	process
File created	C:\Program Files\Uninstall Information\lsass.exe	WinNetCache.exe
File created	C:\Program Files\Uninstall Information\6203df4a6bafc7c328ee7f6f8ca0a8a838a8a1b9	WinNetCache.exe

Drops file in Windows directory 5 IoCs

Processes:

WinNetCache.exe

description	ioc	process
File created	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Cortana.Internal.Search\SearchApp.exe	WinNetCache.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Cortana.Internal.Search\SearchApp.exe	WinNetCache.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Cortana.Internal.Search\38384e6a620884a6b69bcc56f80d556f9200171c	WinNetCache.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AppxManifest\StartMenuExperienceHost.exe	WinNetCache.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AppxManifest\55b276f4edf653fe07efe8f1ecc32d3d195abd16	WinNetCache.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
556	schtasks.exe
4028	schtasks.exe
3200	schtasks.exe
688	schtasks.exe
2372	schtasks.exe
1400	schtasks.exe
2744	schtasks.exe
2776	schtasks.exe
3468	schtasks.exe
4532	schtasks.exe

Modifies registry class 1 IoCs

Processes:

WinNetCache.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings WinNetCache.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2304 PING.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

WinNetCache.exeRuntimeBroker.exe

pid process

3564 WinNetCache.exe
4568 RuntimeBroker.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

WinNetCache.exeRuntimeBroker.exe

description pid process

Token: SeDebugPrivilege 3564 WinNetCache.exe
Token: SeDebugPrivilege 4568 RuntimeBroker.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	WinNetCache.exe

pid	process
2304	PING.EXE

pid	process
3564	WinNetCache.exe
4568	RuntimeBroker.exe

description	pid	process
Token: SeDebugPrivilege	3564	WinNetCache.exe
Token: SeDebugPrivilege	4568	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

HEUR-Trojan.Win32.Generic-7fe5834f29daabc2f00.exeWinNetCache.execmd.exe

description	pid	process	target process
PID 4876 wrote to memory of 3564	4876	HEUR-Trojan.Win32.Generic-7fe5834f29daabc2f00.exe	WinNetCache.exe
PID 4876 wrote to memory of 3564	4876	HEUR-Trojan.Win32.Generic-7fe5834f29daabc2f00.exe	WinNetCache.exe
PID 3564 wrote to memory of 1400	3564	WinNetCache.exe	schtasks.exe
PID 3564 wrote to memory of 1400	3564	WinNetCache.exe	schtasks.exe
PID 3564 wrote to memory of 2744	3564	WinNetCache.exe	schtasks.exe
PID 3564 wrote to memory of 2744	3564	WinNetCache.exe	schtasks.exe
PID 3564 wrote to memory of 556	3564	WinNetCache.exe	schtasks.exe
PID 3564 wrote to memory of 556	3564	WinNetCache.exe	schtasks.exe
PID 3564 wrote to memory of 4028	3564	WinNetCache.exe	schtasks.exe
PID 3564 wrote to memory of 4028	3564	WinNetCache.exe	schtasks.exe
PID 3564 wrote to memory of 3200	3564	WinNetCache.exe	schtasks.exe
PID 3564 wrote to memory of 3200	3564	WinNetCache.exe	schtasks.exe
PID 3564 wrote to memory of 2776	3564	WinNetCache.exe	schtasks.exe
PID 3564 wrote to memory of 2776	3564	WinNetCache.exe	schtasks.exe
PID 3564 wrote to memory of 688	3564	WinNetCache.exe	schtasks.exe
PID 3564 wrote to memory of 688	3564	WinNetCache.exe	schtasks.exe
PID 3564 wrote to memory of 2372	3564	WinNetCache.exe	schtasks.exe
PID 3564 wrote to memory of 2372	3564	WinNetCache.exe	schtasks.exe
PID 3564 wrote to memory of 3468	3564	WinNetCache.exe	schtasks.exe
PID 3564 wrote to memory of 3468	3564	WinNetCache.exe	schtasks.exe
PID 3564 wrote to memory of 4532	3564	WinNetCache.exe	schtasks.exe
PID 3564 wrote to memory of 4532	3564	WinNetCache.exe	schtasks.exe
PID 3564 wrote to memory of 4748	3564	WinNetCache.exe	cmd.exe
PID 3564 wrote to memory of 4748	3564	WinNetCache.exe	cmd.exe
PID 4748 wrote to memory of 1848	4748	cmd.exe	chcp.com
PID 4748 wrote to memory of 1848	4748	cmd.exe	chcp.com
PID 4748 wrote to memory of 2304	4748	cmd.exe	PING.EXE
PID 4748 wrote to memory of 2304	4748	cmd.exe	PING.EXE
PID 4748 wrote to memory of 4568	4748	cmd.exe	RuntimeBroker.exe
PID 4748 wrote to memory of 4568	4748	cmd.exe	RuntimeBroker.exe

C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.Win32.Generic-7fe5834f29daabc2f00.exe
"C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.Win32.Generic-7fe5834f29daabc2f00.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4876

C:\Users\Admin\AppData\Roaming\WinNetCache\WinNetCache.exe
"C:\Users\Admin\AppData\Roaming\WinNetCache\WinNetCache.exe"
2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3564

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Cortana.Internal.Search\SearchApp.exe'" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:1400

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\System32\tetheringclient\lsass.exe'" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:2744

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\All Users\Packages\sppsvc.exe'" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:556

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\ncuprov\RuntimeBroker.exe'" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:4028

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\lsass.exe'" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:3200

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\System32\tsf3gip\fontdrvhost.exe'" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:2776

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\System32\advpack\fontdrvhost.exe'" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:688

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AppxManifest\StartMenuExperienceHost.exe'" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:2372

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Default\spoolsv.exe'" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:3468

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "upfc" /sc ONLOGON /tr "'C:\odt\upfc.exe'" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:4532

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\R5vOLwwPJF.bat"
3⤵
- Suspicious use of WriteProcessMemory
PID:4748

C:\Windows\system32\chcp.com
chcp 65001
4⤵
PID:1848

C:\Windows\system32\PING.EXE
ping -n 5 localhost
4⤵
- Runs ping.exe
PID:2304

C:\Windows\System32\ncuprov\RuntimeBroker.exe
"C:\Windows\System32\ncuprov\RuntimeBroker.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4568

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Winlogon Helper DLL

1

T1004

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\R5vOLwwPJF.bat
Filesize
211B

MD5
c526ed88110620c685ff826c573bf5c8

SHA1
1d24a49cf5889567c05f169d262fc280b3b9faeb

SHA256
c9b955d766672713356c054c9cd69ee9ac404a49b2f37aea20896d78a2653948

SHA512
3623339410a33128a9ff1bcd1f697d59e79a4e7f181aae5dba55c4c8798fe34ce88a06c923e7256e999a3d9da0c97e111d563a6240ef115ffd2ded8f0c050414

Download Submit
C:\Users\Admin\AppData\Roaming\WinNetCache\WinNetCache.exe
Filesize
579KB

MD5
a5bb468e6bb248387e71ff2692106d47

SHA1
c673a5f6bee9ad99068a43455fac19cb4ffb948b

SHA256
5caa9414d268c408b9a82f4442a87efa2f7f4058d44de616a17da6c5ab113bc3

SHA512
fd8bdbb071ab7191ade1b19af740ceefd3743effa69c265a51bd98508aa62b73217e6fc99f19b09bd75d5403d71370a73575dd7fad3a9d1c679d0a1d7f3e743e

Download Submit
C:\Users\Admin\AppData\Roaming\WinNetCache\WinNetCache.exe
Filesize
579KB

MD5
a5bb468e6bb248387e71ff2692106d47

SHA1
c673a5f6bee9ad99068a43455fac19cb4ffb948b

SHA256
5caa9414d268c408b9a82f4442a87efa2f7f4058d44de616a17da6c5ab113bc3

SHA512
fd8bdbb071ab7191ade1b19af740ceefd3743effa69c265a51bd98508aa62b73217e6fc99f19b09bd75d5403d71370a73575dd7fad3a9d1c679d0a1d7f3e743e

Download Submit
C:\Windows\System32\ncuprov\RuntimeBroker.exe
Filesize
579KB

MD5
a5bb468e6bb248387e71ff2692106d47

SHA1
c673a5f6bee9ad99068a43455fac19cb4ffb948b

SHA256
5caa9414d268c408b9a82f4442a87efa2f7f4058d44de616a17da6c5ab113bc3

SHA512
fd8bdbb071ab7191ade1b19af740ceefd3743effa69c265a51bd98508aa62b73217e6fc99f19b09bd75d5403d71370a73575dd7fad3a9d1c679d0a1d7f3e743e

Download Submit
C:\Windows\System32\ncuprov\RuntimeBroker.exe
Filesize
579KB

MD5
a5bb468e6bb248387e71ff2692106d47

SHA1
c673a5f6bee9ad99068a43455fac19cb4ffb948b

SHA256
5caa9414d268c408b9a82f4442a87efa2f7f4058d44de616a17da6c5ab113bc3

SHA512
fd8bdbb071ab7191ade1b19af740ceefd3743effa69c265a51bd98508aa62b73217e6fc99f19b09bd75d5403d71370a73575dd7fad3a9d1c679d0a1d7f3e743e

Download Submit
memory/556-142-0x0000000000000000-mapping.dmp

Download
memory/688-146-0x0000000000000000-mapping.dmp

Download
memory/1400-140-0x0000000000000000-mapping.dmp

Download
memory/1848-152-0x0000000000000000-mapping.dmp

Download
memory/2304-154-0x0000000000000000-mapping.dmp

Download
memory/2372-147-0x0000000000000000-mapping.dmp

Download
memory/2744-141-0x0000000000000000-mapping.dmp

Download
memory/2776-145-0x0000000000000000-mapping.dmp

Download
memory/3200-144-0x0000000000000000-mapping.dmp

Download
memory/3468-148-0x0000000000000000-mapping.dmp

Download
memory/3564-153-0x00007FF8A9BD0000-0x00007FF8AA691000-memory.dmp

Filesize
10.8MB

Download
memory/3564-134-0x0000000000000000-mapping.dmp

Download
memory/3564-138-0x00007FF8A9BD0000-0x00007FF8AA691000-memory.dmp

Filesize
10.8MB

Download
memory/3564-137-0x0000000000490000-0x0000000000528000-memory.dmp

Filesize
608KB

Download
memory/4028-143-0x0000000000000000-mapping.dmp

Download
memory/4532-149-0x0000000000000000-mapping.dmp

Download
memory/4568-155-0x0000000000000000-mapping.dmp

Download
memory/4568-158-0x00007FF8A99F0000-0x00007FF8AA4B1000-memory.dmp

Filesize
10.8MB

Download
memory/4568-159-0x00007FF8A99F0000-0x00007FF8AA4B1000-memory.dmp

Filesize
10.8MB

Download
memory/4748-150-0x0000000000000000-mapping.dmp

Download
memory/4876-132-0x0000000000CD0000-0x0000000000E5A000-memory.dmp

Filesize
1.5MB

Download
memory/4876-139-0x00007FF8A9BD0000-0x00007FF8AA691000-memory.dmp

Filesize
10.8MB

Download
memory/4876-133-0x00007FF8A9BD0000-0x00007FF8AA691000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads